PO for LAN failover and stateful failover link?

Hi.. We have 2 x ASA 5520s running ver 9.0. We plan to aggregate the 2 interfaces used for LAN failover and stateful failover into a lacp PO. So both the ASAs are connected to each other directly using these 2 interfaces and then we logically make it a one PO. We then assign the PO intface an ip. Is this supported?

You can use any unused interface (physical, redundant, or EtherChannel) as the failover link. (Source)
That said, It would be an uncommon implementation. I almost always see them on separate physical interfaces.

Similar Messages

HT204088 charged twice for an app and report problem link not working help

Please help charged twice for an app and link does not work to report this rang apple they cant help because apps are all online only

Go here:
http://www.apple.com/support/itunes/contact/
and follow the instructions to report the issue to the iTunes Store.
Regards.

CS masters is activated but still asking for serial number and stating it's invalid!

I recently used fireworks, but at startup it suddenly asked me for my serial number for CS6 master collection. upon entering the serial number it states that this is invalid!
This is unacceptable. I tried reinstalling, but this does not help either.
How can this be resolved?

Error "The serial number is not valid for this product" | Creative Suite

Table for PO order and material document link

Hello,
I want to extract PO order and respecitive material documents ( IR , GR docs.)
Can you give table(s) names ?
Thanks,
Ishak

Hi ,
You can use 2LIS_02_ITM ,2LIS_02_SCL DataSource you also check the following DataSources
2LIS_02_SCL Tables EKKO, EKBE, T001, T001W, EKET, EKPA.
2LIS_02_HDR Tables EKKO, EKBE, T001, EKPA.
2LIS_02_ITM Tables EKKO, EKBE, T001, T001W, EKPO, TMCLVBW, T027C, ESSR, T147K, T147
2LIS_02_SCN Tables EKET, EKES, EKPO.
2LIS_02_CGR Tables EKBE, EKES, EKPO.
2LIS_02_SGR Tables EKET, EKBE, KKPO
Thanks
REddy

Active/Standby And failover link configuration mode

Hi everyone,
When config failover link of ASA in Active Standby mode.
When we config failover int say gi0/1
config t
int gi0/1
failover lan int gi0/1
Need to confirm we do this from interface config mode only or we can do this from global config also ????????
Whe we assign IP to this int we do that from global config mode ????
Regards
Mahesh
Message was edited by: mahesh parmar
Message was edited by: mahesh parmar

Hi,
Actually the ASA lets you insert a lot of command what ever mode you are under.
In the output you posted is a very important thing to notice
configure mode commands/options:
WORD Specify the interface name
As you can see, the output lists only one option and before that it mentions that this is a "configure mode" command
So even if you entered the command under the interface configuration mode, it would still be entered as a global/configure command mode.
Take the following thing for example
I want to check what configuration options I have with the command "failover"
So I enter the following to my ASA
ASA(config)# failover ?
configure mode commands/options:
interface              Configure the IP address to be used for failover and/or
                              stateful update information
interface-policy    Set the policy for failover due to interface failures
key                       Configure the failover shared secret or key
lan                       Specify the unit as primary or secondary or configure the
                               interface and vlan to be used for failover communication
mac                      Specify the virtual mac address for a dynamic interface
polltime                Configure failover poll interval
timeout                 Specify the failover reconnect timeout value for
                               asymmetrically routed sessions
exec mode commands/options:
active          Make this system to be the active unit of the failover pair
exec            Execute command on the designated unit
reload-standby Force standby unit to reboot
reset           Force a unit or failover group to an unfailed state
As you can see, the ASA tells us that there are different additional command parameters after the "failover" command that can be used. Some of them can be used either in Exec or Configuration mode.
- Jouni

Active/Standby Failover with pair of 5510s and redundant L2 links

Hi
I just got two ASA5510-SEC-BUN-K9 and I'm wondering is it possible to implement an Active/Standby Failover configuration (Routed mode) with two ASA5510 and redundant pair of switches from both inside and outside interfaces? In other words, I would like to have two L2 links from each ASA (in pair od ASAa) to each L2 switch (in pair of redundant L2 Switches). The configuration I would like to achive is just like one in Cisco Security Appliance Command Line Configuration Guide, page B-23, figure B-8, with only difference that I wouldn't go with multiple security contexts (I want Active/Standby failover).
Thanks in advance
Zoran Milenkovic

Hello Zoran,
Absolutely. You can have 2 ASAs configured in Active/Standby mode. For reference, here is a link which has a network connectivity diagram based on PIX, however, connectivity would still be same with ASAs-
http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/failover.html#wp1053462
The difference is that on ASA, you can only have LAN-Based failover, hence you'll need to use one additional interface on both ASAs for failover-link. You can connect these two failover-link interfaces directly using a cross cable.
Apart from this, please refer to following link on how to go with configuration of Lan-based Active/Standby failover-
http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/failover.html#wp1064158
Also make sure that both ASAs have required hardware/software/license based on following link-
http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/failover.html#wp1047269
Hope this helps.
Regards,
Vibhor.

Received a email from Apple stating that my Apple ID was used for a purchase not on my device. It had a link to cancel purchase but asked for my email and password which I gave then it wanted my credit card info! I didn't give that,what should I do?

Received a email from Apple stating that my Apple ID was used for a purchase not on my device. It had a link to cancel purchase but asked for my email and password which I gave then it wanted my credit card info! I didn't give that,what should I do? Do you think this is just a way to get my credit card information?

It sounds like a phishing email. You can't "cancel" purchases. You've now given them your AppleID and password, so you should immediately change your password to something new and very secure.
Also watch out for suspicicious activity on your account.

ASA 5580 with EtherChannel 20Gbs, Does the Failover link must match the same Speed?

Hello,
I have an ASA 5580, I am plannning on setting two EtherChannels (inside and outside), each channel will include two TenGigabit interfaces.
My questions is that if the links that I am gonig to use for the failover and link, should also be 20Gbs each, or it is ok to use 10Gbs for each link?
According to the Configuration guide 8.4
Use the following failover interface speed guidelines for the ASAs:
• Cisco ASA 5510
– Stateful link speed can be 100 Mbps, even though the data interface can operate at 1 Gigabit due
to the CPU speed limitation.
• Cisco ASA 5520/5540/5550
– Stateful link speed should match the fastest data link.
• Cisco ASA 5580/5585
– Use only non-management 1 Gigabit ports for the stateful link because management ports have
lower performance and cannot meet the performance requirement for Stateful Failover.
Thanks in advance

Hi,
I have 2x ASA5580-20 with 8x1GE interfaces and additional 2x 10GE interfaces each. Software version running is v8.4.4.1.
I am planning to use them in multiple context (active/active) transparent mode. Taking into account the FW performance of 5Gbps real-world traffic per ASA5580-20, which on the following interface configurations would make the most sense?
Option 1:
2x10GE = 20GE Etherchannel for Data
1x1GE LAN Failover
1x1GE STATE Failover
Option 2:
1x 10GE Data
1x 10GE LAN & STATE Failover
Option 3:
2x10GE = 20GE Etherchannel for Data
4x1GE = 4GE Etherchannel for LAN/STATE Failover (possibly up to 8x1GE)
(etherchannel for LAN/STATE Failover actually does not make much sense, since only one interface wll be used anyway)
Option 4:
1x10GE LAN & STATE Failover
8x1GE = 8 GE Etherchannel for Data
I have read several guides (e.g. link1, link2, link3). Some state that 1GE Failover interfaces would suffice for the ASA5580, others recommend a link as fast as the data link. Almost none of them account for higher bandwidth etherchannels.
What is recommended in this case? Both Firewalls will be connected to one VSS Switch Pair, so it would make sense to cross-connect with at least 2 links on each VSS member.
The ASA does not support connecting an EtherChannel to a switch stack. If the ASA EtherChannel is connected cross stack, and if the Master switch is powered down, then the EtherChannel connected to the remaining switch will not come up. (http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/interface_start.html)
Thanks in advance for your feedback!

Failover link in a C65K VSS with ASA-SM

Hi
Just experienced a coombined tcp flood/ udp flood attack, which caused both ASAs to go active :-(
Active:
01:56:05 ASA-SM1 : %ASA-1-105043: (Primary) Failover interface failed
01:56:09 ASA-SM1 : %ASA-1-105042: (Primary) Failover interface OK
01:56:32 ASA-SM1 : %ASA-1-103001: (Primary) No response from other firewall (reason code = 3).
01:56:47 ASA-SM1 : %ASA-1-103001: (Primary) No response from other firewall (reason code = 4).
The standby ASA said ' failover off' but a reload of the standby fixed the dual active problem:
Standby:
ASA-SM1# sh failo
Failover Off
Failover unit Secondary
Failover LAN Interface: folink Vlan998 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
ASA-SM1# sh failo state
                    State          Last Failure Reason      Date/Time
This host -   Secondary
                     Disabled       None
Other host -   Primary
                    Not Detected   Comm Failure    01:55:59
'Service-policy in' on the uplink interface (was 512/10 before):
embryonic-conn-max 256 per-client-embryonic-max 5
Questions:
1. possible causes for the com failure (memory exhaust ?) Any good commands for checking ?
2. The failover link:
In an ASA appliance setup it is recomended to etasblish a dedicated physical failover link between til ASAs - What about ASA-SM in a VSS setup - does it make sense to establish a f.ex physical 1G link for failover, and if yes: won't there be a loop issue with this and the fo vlan on the VSL link ?
3. What is "interface policy 1" in the 'sh failo' command output ?
Thanks
Jesper

Hello Adrian,
Don't know if this is the cause of your issue, but I was thinking about scenario in which after your ISP interface is doing DOWN and UP your IP address is being changed.
IOS itself is not deleting isakmp SA because the interface on which you have crypto map attached is down, so the SA will be still up on IOS. On ASA itself since you have default configuration you have DPD (dead peer detection) turned on probably after 10 seconds crypto sa will go down since no DPD reply received.
IOS will continue to send encrypted traffic towards ASA, but for ASA tunnel is dead and it will ignore these packets (there should be something in logs), but router will never know it since it has DPDs turned off.
It could also happen if you are getting the same IP address from you ISP, but Internet outages are longer than 30seconds.
Solution would be to turn on DPDs on IOS:
crypto isakmp keepalives TIME_IN_SECONDS periodic
Defailts about DPDs:
https://supportforums.cisco.com/docs/DOC-8554
Regards,

Failover link inteface redundant

hola estoy tratando de configurar un asa active/standby pero a su vez tratanto de que la interface failover link sea una interface redudant segun la documentacio es posible pero al configurar me indica que una interface compartida no es factible , no encuentro la configuracion correcta son dos ASA5525X version
Cisco Adaptive Security Appliance Software Version 8.6(1)2
Device Manager Version 7.0(2)

Hola Julio
claro no hay problema esta es la configuracion actual de mis interfaces y interfaces redundantes quiero utilizar la interfaces G0/5 y G/6 como mi interface failover , no estoy seguro si funcionara?
interface GigabitEthernet0/5
no nameif
no security-level
no ip address
interface GigabitEthernet0/6
no nameif
no security-level
no ip address
interface GigabitEthernet0/7
description LAN/STATE Failover Interface
interface Redundant1
member-interface GigabitEthernet0/2
member-interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 172.18.100.X 255.255.255.0 standby 172.18.100.X
interface Redundant2
member-interface GigabitEthernet0/0
member-interface GigabitEthernet0/3
nameif vpn-outside
security-level 0
ip address 10.245.245.x 255.255.255.0 standby 10.245.245.x
interface Redundant3
description Failover
member-interface GigabitEthernet0/5
member-interface GigabitEthernet0/6
no nameif
no security-level
no ip address
failover
failover lan unit primary
failover lan interface failover GigabitEthernet0/7
failover polltime unit msec 500 holdtime 3
failover key *****
failover replication http
failover link failover GigabitEthernet0/7
failover interface ip failover 172.32.254.1 255.255.255.252 standby 172.32.254.2
al configurar esta es la secuencia de error
VPN5525X-VLP(config)# no failover lan interface failover GigabitEthernet0/7
VPN5525X-VLP(config)# no failover link failover GigabitEthernet0/7
VPN5525X-VLP(config)# failover lan interface failover redunda
VPN5525X-VLP(config)# failover lan interface failover redundant3
INFO: Non-failover interface config is cleared on Redundant3 and its sub-interfaces
VPN5525X-VLP(config)# failover link failover Redunan
VPN5525X-VLP(config)# failover link failover Redundant3
VPN5525X-VLP(config)#
VPN5525X-VLP(config)#
VPN5525X-VLP(config)# exit
VPN5525X-VLP# sh run fa
ya esta configurado pero no estoy seguro si funcionara, Julio que asi configurado.
VPN5525X-VLP# sh run failover
failover
failover lan unit primary
failover lan interface failover Redundant3
failover polltime unit msec 500 holdtime 3
failover key *****
failover replication http
failover link failover Redundant3
VPN5525X-VLP#

Failover link

Hello,
On an ASA 5520 active, standby pair, what will result if the failover link or interface goes down or fails. Will both devices become active?
If yes, how to prevent this. We want it in such a way that if such a situation happens, there should be only Active and the other one should be standby.
Thanks in advance!

If ASA units connected with cross over then no failover will take place.
if using LAN based failover then you will end up with Active-Active and traffic will fail.
Thanks
Ajay

Redundant Failover link on ASA5500 Series?

Cisco recommends connecting failover link over L2 switch in thier document.
But if L2 switch fails, both ASA's failover I/F will down.
I wonder if there is any way to get redundancy for failover link, like etherchannel.
Or should I prepare two L2 switches to avoid both ASA's I/F down?
Any hints appriciated.

Even if both of the failover interfaces go down it wont affect the traffic flow. Also if the switch is being monitored this will get detected and can be solved easily. If you still want redundant failover links, using seperate switches will be good idea.

ASA redundant failover links

Hi,
We are setting up a new ASA which is in multi context mode. I was wondering if it is possible to setup redundant failover and state links? I know that it is possible to run failover on one link and state on another, or both over the same link, but is it possible to have both failover and state running on 2 links? For example, failover and state on ten1/0 as well as failover and state on ten1/1.
Hope I have explained my question well enough. If not I will try to explain better.
thanks

I would suggest to make a redundant logical link and attach two physical links to it. Than during failover link configuration specify your redundant link as a failover link. Not sure if it works but dont see any obstacles for this solution to fail..

I installed windows 7 on my macbook pro. all is working but lan adaptor and sound od laptop is not working. please help me or send the link where i can download the these drivers.

I installed windows 7 on my macbook pro. all is working but lan adaptor and sound od laptop is not working. please help me or send the link where i can download the these drivers.I have lost my resource cd .

If you are running Lion or Mountain Lion, the drivers are downloaded from within Bootcamp Assistant. If you are running Snow Leopard the drivers are on your Snow Leopard install disk.
Read the Bootcamp Install Guide for your version of OSx. http://www.apple.com/support/bootcamp/
Bootcamp questions should be asked in the Bootcamp forum where the Bootcamp gurus hang out https://discussions.apple.com/community/windows_software/boot_camp

TCP connection for DHCP failover frequently are broken in Solaris 10

Hi
We have two dhcp servers which are installed in Solaris 10 and set to a failover pair. Currently, we can find that tcp connection for dhcp failover protocol are frequently broken. It looks like that primary dhcp server initiatively send FIN message to secondary one but in general, this tcp connection should always keep alive. On the other hand, the tcp connection can not completely be closed right now which FIN_WAIT_2 status in Primary one and CLOSE_WAIT status in secondary would last for a long time.
Will Solaris 10 cause this fault? Is it a known bug in OS?
OS info:
-bash-3.00$ cat /etc/release
Solaris 10 5/08 s10s_u5wos_10 SPARC
Copyright 2008 Sun Microsystems, Inc. All Rights Reserved.
Use is subject to license terms.
Assembled 24 March 2008
-bash-3.00$
-bash-3.00$
-bash-3.00$ uname -a
SunOS edns1 5.10 Generic_142900-03 sun4v sparc SUNW,Netra-T5220
TCP connection info:
Primary DHCP Server:
2012 08 29 03:41:43
PING 172.25.6.137: 56 data bytes 64 bytes from edns2 (172.25.6.137): icmp_seq=0. time=0.678 ms
remote refid st t when poll reach delay offset disp
==============================================================================
*idns1           195.26.151.151   3 u   45 1024 377     0.75   -0.071    0.05
+idns2           195.26.151.151   3 u 162 1024 377     0.93    0.169    0.08
clusternode1-pr 0.0.0.0 16 - - 1024 0 0.00 0.000 16000.0
+clusternode2-pr idns1            4 u 406 1024 376     0.49   -0.154   15.12
172.25.6.133.647 172.25.6.137.58107 49640 0 49640 0 ESTABLISHED
172.25.6.133.647 *.* 0 0 49152 0 LISTEN
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
2012 08 29 03:41:47
PING 172.25.6.137: 56 data bytes 64 bytes from edns2 (172.25.6.137): icmp_seq=0. time=0.535 ms
remote refid st t when poll reach delay offset disp
==============================================================================
*idns1           195.26.151.151   3 u   49 1024 377     0.75   -0.071    0.05
+idns2           195.26.151.151   3 u 166 1024 377     0.93    0.169    0.08
clusternode1-pr 0.0.0.0 16 - - 1024 0 0.00 0.000 16000.0
+clusternode2-pr idns1            4 u 410 1024 376     0.49   -0.154   15.12
172.25.6.133.647 172.25.6.137.58107 49640 0 49640 0 FIN_WAIT_2
172.25.6.133.647 *.* 0 0 49152 0 LISTEN
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Secondary DHCP Server:
2012 08 29 03:41:41
PING 172.25.6.133: 56 data bytes 64 bytes from edns1 (172.25.6.133): icmp_seq=0. time=1.26 ms
remote refid st t when poll reach delay offset disp
==============================================================================
*idns1           195.26.151.151   3 u 450 1024 377     0.92   -0.067    0.06
+idns2           195.26.151.151   3 u 552 1024 377     0.96    0.237    0.08
+clusternode1-pr idns1            4 u 360 1024 377     1.85   -0.528    1.51
clusternode2-pr 0.0.0.0 16 - - 1024 0 0.00 0.000 16000.0
172.25.6.137.647 *.* 0 0 49152 0 LISTEN
172.25.6.137.58107 172.25.6.133.647 49640 0 49640 0 ESTABLISHED
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
2012 08 29 03:41:45
PING 172.25.6.133: 56 data bytes 64 bytes from edns1 (172.25.6.133): icmp_seq=0. time=1.36 ms
remote refid st t when poll reach delay offset disp
==============================================================================
*idns1           195.26.151.151   3 u 454 1024 377     0.92   -0.067    0.06
+idns2           195.26.151.151   3 u 556 1024 377     0.96    0.237    0.08
+clusternode1-pr idns1            4 u 364 1024 377     1.85   -0.528    1.51
clusternode2-pr 0.0.0.0 16 - - 1024 0 0.00 0.000 16000.0
172.25.6.137.647 *.* 0 0 49152 0 LISTEN
172.25.6.137.58107 172.25.6.133.647 49640 0 49640 0 CLOSE_WAIT
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Thanks!

Thanks, but had found a previous discussion with this hint and applied it.
svccfg -s sendmail listprop shows config /local_only = false
Yes, I would really love to fix the fault, but what I would really like is some hints as to how to debug ports under svc control.

PO for LAN failover and stateful failover link?

Similar Messages

Maybe you are looking for